Identity & Access Management Enabling e-government. Identity & Access Management (IAM) Defined

Transcription

1 Identity & Access Management Enabling e-government Ed McCarthy, Director of Global Security Sales CA Identity & Access Management (IAM) Defined Delivers answers to key questions: Who has access to what resources? When did they access those resources? What are our access policies? What did they do while they were there? Who authorized that access?

2 What CIOs, CSOs and CFOs Are Telling Us It s too expensive and manual to make sure we re addressing all the necessary regulations. And then we have to do it all over again for the next time April 8, 2008 Improve and Enable Business Copyright 2007 CA What CIOs, CSOs and CFOs Are Telling Us 25% of my help desk calls are related to resetting forgotten passwords! April 8, 2008 Improve and Enable Business Copyright 2007 CA 2

3 What CIOs, CSOs and CFOs Are Telling Us There is just no budget to hire more IT administrators, but our user population is growing, particularly as we bring more customers/partners online April 8, 2008 Improve and Enable Business Copyright 2007 CA What CIOs, CSOs and CFOs Are Telling Us I still have accounts in my systems for users that are long gone! April 8, 2008 Improve and Enable Business Copyright 2007 CA 3

4 What CIOs, CSOs and CFOs Are Telling Us As employees and partners change responsibilities they keep acquiring new system privileges with us while none are removed. How do I fix that? April 8, 2008 Improve and Enable Business Copyright 2007 CA What CIOs, CSOs and CFOs Are Telling Us Internal and external auditors need to see if you have sufficient control over your IT systems and access to private data. Auditors don t care generally how much it costs April 8, 2008 Improve and Enable Business Copyright 2007 CA 4

5 What CIOs, CSOs and CFOs Are Telling Us Enterprise architects hate to see the IT wheel continually reinvented. IAM should be deployed and managed as part of enterprise architecture April 8, 2008 Improve and Enable Business Copyright 2007 CA What CIOs, CSOs and CFOs Are Telling Us I don t want to see my organization in the news April 8, 2008 Improve and Enable Business Copyright 2007 CA 5

6 Identity & Access Management The Challenge >Difficult to admin access rights >High costs MANY USERS >Customers >Employees >Partners April 8, 2008 Improve and Enable Business Copyright 2007 CA Identity & Access Management The Challenge > Security Silos > Inconsistent enforcement MANY USERS >Customers >Employees >Partners MANY APPLICATIONS >Logistics >Financial >Service >Production >CRM >ERP April 8, 2008 Improve and Enable Business Copyright 2007 CA 6

7 Identity & Access Management The Challenge > Difficult administration > Difficult compliance > Reduced security MANY IDENTITIES >Mainframe >RDBMS >LDAP >NOS >ERP MANY USERS >Customers >Employees >Partners MANY APPLICATIONS >Logistics >Financial >Service >Production >CRM >ERP April 8, 2008 Improve and Enable Business Copyright 2007 CA Identity & Access Management The Challenge >High Admin cost > Manual IT Processes MANY IDENTITIES >Mainframe >RDBMS >LDAP >NOS >ERP MANY USERS >Customers >Employees >Partners MANY APPLICATIONS >Logistics >Financial >Service >Production >CRM >ERP MANY ADMINS >Many tactical issues >Managing users, passwords, etc April 8, 2008 Improve and Enable Business Copyright 2007 CA 7

8 The Business Value of IAM Reduced IT Security Risk Protect your critical IT resources Centrally manage all identities and access policies Reduced Operational Expenses Lower your IT Admin and expenses Automate existing manual IT processes Enhanced Audit your complete security environment Achieve sustainable compliance Enhanced Business Enablement Deploy new online services quickly Strengthen your existing customer relationships April 8, 2008 Improve and Enable Business Copyright 2007 CA Identity & Access Management The Solution Security Policy REDUCED MANY IDENTITIES >Easier administration >Reduced >Improved auditing for easier compliance MANY USERS > Single Sign-on > User self-service April 8, 2008 Improve and Enable Business Copyright 2007 CA MANY APPLICATIONS >Centralized Security >Easier app dev CENTRALIZED ADMINISTRATION MANY ADMINS >Reduced admin costs >Consistent admin across platforms >Automation of IT processes 8

9 Identity & Access Management The Solution Security Policy REDUCED IDENTITIES Easier administration MANY USERS 17 April 8, 2008 Improve and Enable Business Copyright 2007 CA MANY APPLICATIONS CENTRALIZED ADMINISTRATION Reduced Reduced admin costs Single Sign-on Centralized Improved auditing for easier Consistent admin across User self-service Security compliance Easier app dev platforms Automation of IT processes Maturity Model for Provisioning to Identity Management

10 What is Identity Management? User Credentials Password Management Grouping and Roles to rules Application function entitlements Separation of Duties (Segregation of Duties) Enrollment (provisioning) Termination (de-provisioning) The Model Situational Analysis Mapping your success Incremental wins Leveraging the future

11 STAGE 1 - Password Management Increased User Productivity Reduced Helpdesk Maturity Gap Incremental Win Blueprint ACTIVE Time Password Mgmt To Be As Is STAGE 2 - Consolidated Identity Mgmt On-boarding new employees MAC for functional assignments Automated Integration Maturity Gap Incremental Win Blueprint EFFICIENT Established Process ACTIVE Time Password Mgmt Id Mgmt To Be As Is

12 STAGE 3 - Roles and Entitlement Mgmt Business Application on-boarding Automated reporting for Governance Established Standards for new applications Reduced entitlements administration Maturity Gap Incremental Win Blueprint Established Process RESPONSIVE EFFICIENT Established Process ACTIVE Time Password Mgmt ID Mgmt Entitlements To Be STAGE 4 - Federated Identity Mgmt Authoritative Credentials Applications as a Service Intranet and Extranet SLA s Standards Compliant BUSINESS DRIVEN Maturity Established Process RESPONSIVE Established Process EFFICIENT Established Process ACTIVE Time Password Mgmt ID Mgmt Entitlements Federation

13 Provisioning to Identity Management - Maturity Model Federated Identity Management 4 Provisioning is extended to support non-it environments Asset management integration with provisioning is supported Web services are used for integration between business applications Federated trust is implemented to enable external SPML requests CMDB changes automatically opens workflow requests into provisioning Integrated Role and Entitlement Management 3 Common Directory Infrastructure Role-based provisioning is now supported for most critical systems and applications Automated generation of entitlement exception reports Business workflows are defined Development uses an externalized security framework Consolidated Identity Management 2 Automate Basic User Management and Provisioning which mostly extends to mostly infrastructure platforms and applications (AD, MF, UNIX, , etc) Basic Entitlement Reporting on user access is enabled Delegated administration is offered to business units and helpdesk Password Management 1 Self Service Password Management which allow users to reset their own passwords without calling the helpdesk SUMMARY - ID Mgmt Checklist Authoritative Directory(ies) What is my best source for User information? Critical Applications Which Applications have the highest Exposure? Which Applications create the most HelpDesk issues? Which Applications provide the Highest Productivity? Which Applications contain or connect to high value data? Segregation of Duties Who are the critical IT Administrators? Who are the key Security Administrators? Which business unit(s) benefit most from an automated approach? Business Agreements Business Units that deal with other departments and other companies

14 What CA s IAM Solution Will Do For You Secure user identities and access policies across your enterprise Provide repeatable, defendable and sustainable compliance Reduce IT expenses through automation Protect IT resources to reduce risk Enable business securely with faster time to market Manage centrally, and flexibly, to distribute across your business CA is the Right Choice Broadest & most integrated suite CA CA has one of the broadest and most integrated set of identity management solutions on the market today. Few vendors have enterprise single sign-on (etrust SSO), host access control (etrust Access Control) or Web services security (etrust TransactionMinder), and CA stands alone with all three. 17.1% Forrester Research, January 2006* IBM 10.9% RSA VeriSign Novell 2.7% 8.7% 6.3% IDC, IAM 2005 Vendor Shares #1 for 6 consecutive years Sun 1.2% BMC 0.9% HP 0.6% Best of Breed Even before the acquisition of Netegrity in 2004, CA had a very broad identity management (IdM) product suite. With the acquisition of Netegrity, CA s IdM suite now includes provisioning, web access management (WAM), federation, enterprise single sign-on (SSO), Web services security, operating systems security (for mainframes, UNIX, and Windows) and directory products. Burton Group, March 2006* Sources: CA Provisioning Delivers Strong Auditing and Atop A robust Architecture, Forrester Research, Jan 30, 2006 IDC, WW Identity and Access Management 2005 Vendor Shares, Sally Hudson, Doc #203296, Sept 2006 Burton Group, CA Identity Manager r8.1, Mark Diodati, March April 8, 2008 Improve and Enable Business Copyright 2007 CA

15 Thank You